all authorization functions work